See how gpac compares to other vendors in security performance
A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidxboxread of the file src/isomedia/boxcodebase.c. The manipulation leads to allocation of resources. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is 442e2299530138d8f874fd885c565ba98a6318ba. It is suggested to install a patch to address this issue.
Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svgattributes.c, svgparsestrings(), gfsvgparseattribute()
GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gfsgvrmlfieldclone() to memcpy from invalid pointers and crash.
An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gfavcchangevui /afltest/gpac/src/mediatools/avparsers.c:6872:55 allows attackers to crash the application.
Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2.
GPAC 2.1-DEV-rev87-g053aae8-master. has a Null Pointer Dereference vulnerability in gfisomparsemovieboxesinternal due to improper return value handling of GFSKIPBOX, which causes a Denial of Service. This vulnerability was fixed in commit 37592ad.
Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV.
MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function diSTboxread() to read from video. In this function, it allocates a buffer str with fixed length. However, content read from bs is controllable by user, so is the length, which causes a buffer overflow.
Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/isomread.c:2807:51 function in gfisomgetuserdata.
GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vulnerability exists in the gfxmlparsebitsequencebs function in utils/xmlbincustom.c when processing a crafted NHML file containing malicious <BS> (BitSequence) elements. An attacker can exploit this by providing a specially crafted NHML file, causing an out-of-bounds write on the heap. This issue has been via commit 86b0e36.
GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vulnerability exists in the gfxmlparsebitsequencebs function in utils/xmlbincustom.c when processing a crafted NHML file containing malicious <BS> (BitSequence) elements. An attacker can exploit this by providing a specially crafted NHML file, causing an out-of-bounds write on the heap. This issue has been via commit 86b0e36.
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gfparselfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gfparselfrac() to divide by zero, terminating the process with SIGFPE.
GPAC through 26.07.0 contains a type confusion vulnerability in drawablegetaspect2dmpeg4() and TraverseShape() that casts a Shape's appearance node to MAppearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.
Motion Spell GPAC contains a null pointer dereference vulnerability that could allow a local attacker to cause a denial-of-service (DoS) condition.
An out-of-bounds read in gfodfac4cfgdsiv1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
A segmentation violation in the gfisomgetesd function (/isomedia/isomread.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.
A NULL pointer dereference in the StatSFVec2f function (/scenemanager/scenestats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.
A segmentation violation in the checkmediaprofile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A NULL pointer dereference in the dasherinserttimelineentry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A heap buffer overflow in the stblAddSize function (isomedia/stblwrite.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A heap use-after-free in the dasherflushsegment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A use-after-free in the gffilterpidgetpacket function (filtercore/filterpid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
A segmentation violation in the dumpisomsaps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60475 CWE: CWE-125 (Out-of-bounds Read) CVSS 3.1: Not assessed Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The gfac4parserbs() function in GPAC's AC-4 parser (mediatools/avparsers.c:16140) accesses AC4SAMPLEDELTATABLE48 using a framerateindex read from the input stream without proper bounds checking. When MP4Box inspects a crafted AC-4 stream, an invalid index causes a 4-byte read beyond the global array boundary.
AddressSanitizer reports a global-buffer-overflow read at address 0x7f8be83df95c, located 4 bytes after the 56-byte global array AC4SAMPLEDELTATABLE48. The read is reached through ac4dmxprobedata() while probing the input file, crashing the process (Denial of Service).
Crash is reproducible on the current master branch at the time of discovery (2.5-DEV-rev1593-gfe88c3545-master, commit fe88c3545aadd597b250ccf23271d5d3de50ccc8). No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 40gfac4parserbsmediatoolsavparsersc16140
Asan-log: ==1823022==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f8be83df95c at pc 0x7f8be7592fce bp 0x7fff40bffe90 sp 0x7fff40bffe88 READ of size 4 at 0x7f8be83df95c thread T0 #0 0x7f8be7592fcd in gfac4parserbs mediatools/avparsers.c:16140 #1 0x7f8be7ecfcbc in ac4dmxprobedata filters/reframeac4.c:546 #2 0x7f8be7b0262f in gffilterpidrawnew filtercore/filter.c:4704
Fix: Update to a GPAC v26.07.0:
https://github.com/gpac/gpac/releases/tag/v26.07.0 PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/40/40gfac4parserbsmediatoolsavparsersc16140
References: https://github.com/gpac/gpac/issues/3291 https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b https://www.cve.org/CVERecord?id=CVE-2025-60475 https://infosec.exchange/@sigdevel/117456354623831878
—— Best regards, Alexander A. Shvedov @sigdevel
A use-after-free in the gffilterpidinstswapdeletetask function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60467 CWE: CWE-416 (Use After Free) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The gffilterpidinstswapdeletetask() function in GPAC's filter session core (filtercore/filterpid.c:574) is a scheduled task that deletes a GFFilterPidInstance structure during filter PID teardown. When MP4Box inspects a crafted MPEG-2 TS file that drives the filter pipeline through PID reconfiguration and deletion, gffilterpidinstswapdelete() at filtercore/filterpid.c:544 frees the pidinst allocation before the scheduled delete task has executed.
The task callback subsequently performs a READ of 4 bytes at address 0x513000000e7c from the already-freed structure without verifying that the instance is still valid, resulting in a heap-use-after-free and process crash (Denial of Service).
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 37gffilterpidinstswapdeletetaskfiltercorefilterpidc574
Asan-log: ==2014352==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000000e7c at pc 0x7fd50dc51b7d bp 0x7ffe25104a20 sp 0x7ffe25104a18 READ of size 4 at 0x513000000e7c thread T0 #0 0x7fd50dc51b7c in gffilterpidinstswapdeletetask filtercore/filterpid.c:574 #1 0x7fd50dcc3465 in gffsthreadproc filtercore/filtersession.c:2420 #2 0x7fd50dcc86c4 in gffsrun filtercore/filtersession.c:2727
Fix: Update to a GPAC v26.07.0:
https://github.com/gpac/gpac/releases/tag/v26.07.0 PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/37/37gffilterpidinstswapdeletetaskfiltercorefilterpidc574
References: https://github.com/gpac/gpac/issues/3286 https://www.cve.org/CVERecord?id=CVE-2025-60467 https://infosec.exchange/@sigdevel/116780518074911144 https://github.com/gpac/gpac/commit/976dacf65cb6986a4e4f350fb8d3ed0a17dc3a77
—— Best regards, Alexander A. Shvedov @sigdevel
A segmentation violation in the gfpropsequalinternal function (/filtercore/filterprops.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.
A NULL pointer dereference in the gffilterpidresolvefiletemplateex function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60477 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The gffilterpidresolvefiletemplateex function in filtercore/filterpid.c is responsible for resolving output file name templates during DASH segmentation in MP4Box. When input file metadata contains excessively long URLs or HTML-like special characters, the function reaches a strncmp() call at line 9045 without first verifying that one of its pointer arguments is non-NULL.
The NULL pointer is passed directly to strncmp(), causing a READ dereference at address 0x000000000000, which terminates the process immediately. No arbitrary code execution was observed; the impact is limited to Denial of Service.
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -dash 100 48gffilterpidresolvefiletemplateexfiltercorefilterpidc9045
Asan-log: ==55159==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f665c8c1cf0 bp 0x7fff48a84ca0 sp 0x7fff48a84430 T0) ==55159==The signal is caused by a READ memory access. #0 0x7f665c8c1cf0 in strncmp ../../../../src/libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc:491 #1 0x7f665b891e64 in gffilterpidresolvefiletemplateex filtercore/filterpid.c:9045 #2 0x7f665b965c1e in dashersetupsources filters/dasher.c:4234
Fix: Update to a GPAC v26.07.0:
https://github.com/gpac/gpac/releases/tag/v26.07.0 PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/48/48gffilterpidresolvefiletemplateexfiltercorefilterpidc9045
References: https://github.com/gpac/gpac/issues/3301 https://nvd.nist.gov/vuln/detail/CVE-2025-60477 https://infosec.exchange/@sigdevel/116658486442433074
—— Best regards, Alexander A. Shvedov @sigdevel
Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1699-g31becc9e0-master Commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 Fixed: 9afeea23f5c6584c02aefe1e1560c2844dfb8f7e CVE: CVE-2025-60493 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L; third-party assessment) Reporter: Alexander A. Shvedov (@sigdevel)
Description: MP4Box dereferences a near-NULL pointer in checkmediaprofile() at applications/mp4box/mp4box.c:3883 while removing system tracks. A crafted or truncated MP4 file containing invalid MPEG-4 Object Descriptors can cause gfisomgetesd() to return a GFESD whose decoderConfig or decoderSpecificInfo fields are NULL. checkmediaprofile() accesses these fields without first validating them, causing a read at address 0x000000000008.
The issue was reproduced in GPAC version 2.5-DEV-rev1699-g31becc9e0-master at commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9.
Impact: Processing attacker-controlled input causes an immediate MP4Box crash and denial of service. The observed fault is a near-NULL read; arbitrary code execution was not demonstrated.
Reproduction: Build GPAC with AddressSanitizer, then run:
./MP4Box -nosys 63checkmediaprofileapplicationsmp4boxmp4boxc3883
ASan log excerpt: ==85294==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 ==85294==The signal is caused by a READ memory access. ==85294==Hint: address points to the zero page. #0 in checkmediaprofile applications/mp4box/mp4box.c:3883 #1 in removesystemstracks applications/mp4box/mp4box.c:3937 #2 in removesystemstracks applications/mp4box/mp4box.c:3916
Fix: Update to a GPAC v26.07.0:
https://github.com/gpac/gpac/releases/tag/v26.07.0
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/63/63checkmediaprofileapplicationsmp4boxmp4boxc3883
References: https://github.com/gpac/gpac/issues/3328 https://github.com/gpac/gpac/commit/9afeea23f5c6584c02aefe1e1560c2844dfb8f7e https://www.cve.org/CVERecord?id=CVE-2025-60493 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60493.json https://infosec.exchange/@sigdevel/117451489672249554
—— Best regards, Alexander A. Shvedov @sigdevel